8.8

CVE-2025-1244: emacs OS Command Injection

CVSS: 8.8v3.1HighDeferred
AliasesMGASA-2025-0075SUSE-SU-2025:0574-1SUSE-SU-2025:0589-1
Published 12-02-2025Last modified 06-09-2026
Open JSON

Vulnerability summary

CVE-2025-1244 is a high (CVSS 8.8) OS Command Injection vulnerability in emacs. EPSS estimates a 2.63% chance of exploitation in the next 30 days, higher than 85.3% of scored vulnerabilities.

Overall risk
36/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
2.63%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 1
DLA-4069-1DSA-5871-1USN-8011-1

Timeline

  1. 12-02-2025
    PublishedVulnerability first disclosed.
  2. 06-09-2026
    Last modifiedVulnerability information updated.

Description

A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

2.63%

Chance of exploitation in the next 30 days

Percentile

85%

Versus all other CVEs

30-day change

0.00 pp

From 2.63% on 20-09-2026

20-09-202620-10-2026
EPSS score
2.63%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse18 products
  • emacs&distro=SUSE Enterprise Storage 7.1< 25.3-150000.3.25.3
  • emacs&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 25.3-150000.3.25.3
  • emacs&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 27.2-150400.3.23.2
  • emacs&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 27.2-150400.3.23.2
  • emacs&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 27.2-150400.3.23.2
Redhat12 products
  • emacs< 1:27.2-11.el9_5.1 | < 1:26.1-13.el8_10 | < 1:26.1-7.el8_6.6 | < 1:24.3-23.el7_9.2 | < 1:26.1-5.el8_2.3 | < 1:27.2-10.el9_4.1 | < 1:26.1-10.el8_8.7 | < 1:26.1-5.el8_4.3 | < 1:27.2-8.el9_2.2 | < 1:27.2-6.el9_0.2
  • emacs-common< 1:27.2-11.el9_5.1 | < 1:26.1-13.el8_10 | < 1:26.1-7.el8_6.6 | < 1:24.3-23.el7_9.2 | < 1:26.1-5.el8_2.3 | < 1:27.2-10.el9_4.1 | < 1:26.1-10.el8_8.7 | < 1:26.1-5.el8_4.3 | < 1:27.2-8.el9_2.2 | < 1:27.2-6.el9_0.2
  • emacs-common-debuginfo< 1:27.2-11.el9_5.1 | < 1:26.1-13.el8_10 | < 1:26.1-7.el8_6.6 | < 1:26.1-5.el8_2.3 | < 1:27.2-10.el9_4.1 | < 1:26.1-10.el8_8.7 | < 1:26.1-5.el8_4.3 | < 1:27.2-8.el9_2.2 | < 1:27.2-6.el9_0.2
  • emacs-debuginfo< 1:27.2-11.el9_5.1 | < 1:26.1-13.el8_10 | < 1:26.1-7.el8_6.6 | < 1:24.3-23.el7_9.2 | < 1:26.1-5.el8_2.3 | < 1:27.2-10.el9_4.1 | < 1:26.1-10.el8_8.7 | < 1:26.1-5.el8_4.3 | < 1:27.2-8.el9_2.2 | < 1:27.2-6.el9_0.2
  • emacs-debugsource< 1:27.2-11.el9_5.1 | < 1:26.1-13.el8_10 | < 1:26.1-7.el8_6.6 | < 1:26.1-5.el8_2.3 | < 1:27.2-10.el9_4.1 | < 1:26.1-10.el8_8.7 | < 1:26.1-5.el8_4.3 | < 1:27.2-8.el9_2.2 | < 1:27.2-6.el9_0.2
Ubuntu5 products
  • emacs< 1:26.3+1-1ubuntu2+esm2 | < 1:27.1+1-3ubuntu5.2+esm1 | < 1:29.3+1-1ubuntu2+esm3
  • emacs24All versions (No fix recorded)
  • emacs25All versions (No fix recorded)
  • xemacs21All versions (No fix recorded)
  • xemacs21-packagesAll versions (No fix recorded)
Opensuse2 products
  • emacs&distro=openSUSE Leap 15.6< 27.2-150400.3.23.2
  • emacs&distro=openSUSE Tumbleweed< 29.4-14.1
Debian1 product
  • emacs< 1:28.2+1-15+deb12u4 | < 1:30.1+1-1
Mageia1 product
  • emacs< 29.4-1.3.mga9

6 vendors · 39 products

References

42 links
Show all 42 references